CVE-2026-85543

MediumCVSS 4.3/10Last modified Sep 10, 2026

Description

Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration information through these interfaces.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-285

Affected software

No affected versions have been published.

Timeline

Published: Sep 10, 2026
Last modified: Sep 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-855446.1Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with CVE-2026-855457.1There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their CVE-2026-855468.6MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addSer CVE-2026-855476.2A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether a CVE-2026-85558.8Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted CVE-2026-85563.1Inappropriate implementation in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the CVE-2026-855686.8The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already pre CVE-2026-855697.2The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and CVE-2026-85577.5Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process CVE-2026-855716.5The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course CVE-2026-855724.3The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion conten CVE-2026-855738.8The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files